DNScrypt-proxy 2

Recent Commits

• Frank Denis (11 Jul 26)

  local DoH: pad responses, not the incoming query

• Frank Denis (11 Jul 26)

  resolveUsingResolver: don't return an error if we got some IPs Even if this is not the full set of IPs.

• Frank Denis (11 Jul 26)

  pattern matcher: test membership, not nil

• Frank Denis (11 Jul 26)

  When using SOCKS + relay + a simple DNS exchange, send to the relay Not to the server

• Frank Denis (11 Jul 26)

  lock source.refresh

• Frank Denis (11 Jul 26)

  cache: include CD bit in the cache key

• Frank Denis (11 Jul 26)

  Properly parse netprobe_timeout flag.Int is never nil, so the flag's default value silently overrode netprobe_timeout from the TOML file

• Frank Denis (11 Jul 26)

  exchangeWithUDPServerViaProxy: on timeout, directly return an error Instead of trying to decrypt junk (and then return an error, but not the right one.

• Frank Denis (10 Jul 26)

  Initialize the DNS cache at plugin init time No need for a lazily-created cache and sync.Once.

• Frank Denis (10 Jul 26)

  Use cloneMsg instead of shallow Copy for cached DNS messages miekg/dns/v2 Msg.Copy() only does a useless shallow copy of the RR slices, so use cloneMsg instead.

• Frank Denis (10 Jul 26)

  Add a helper funciton to clone (not copy) a dns message

• Frank Denis (10 Jul 26)

  Update deps

• Frank Denis (08 Jul 26)

  Update GitHub actions

• Frank Denis (23 Jun 26)

  Retry HTTP/3 after transient failures. That will cause all DoH connections to block every 30 minute, but Fixes #3258

• Frank Denis (22 Jun 26)

  Rotate keys on IP changes also for classical dnscrypt

• Frank Denis (22 Jun 26)

  Watch for network changes and rotate PQ tickets when needed

• Frank Denis (20 Jun 26)

  Add new undelegated TLDs

• Frank Denis (20 Jun 26)

  Pad certificate queries enough to retrieve PQ certs over UDP An anonymized relay forwards certificate queries to the upstream resolver over UDP only, and both the resolver and the relay refuse to return a UDP response larger than the request that triggered it. A post-quantum certificate is about 1.3 KB, so a small certificate probe came back truncated to the classical certificate alone, and the proxy never learned that the resolver supported X-Wing when it was reached through a relay. Pad the large certificate probe well past the response size to fix this.

• Frank Denis (19 Jun 26)

  Update deps

• Frank Denis (19 Jun 26)

  go.mod: nove things round

• Frank Denis (16 Jun 26)

  Import circl

• Frank Denis (16 Jun 26)

  Implement pqdnscrypt

• Frank Denis (09 Jun 26)

  Resolve against the origin rather than the document URL

• Frank Denis (06 Jun 26)

  Format

• Frank Denis (06 Jun 26)

  Fix cycles detection in cloaking rules Detect actual cycles in the name-target graph instead of rejecting every target that matches any cloak rule. Fixes #3238

• Frank Denis (05 Jun 26)

  Nits

• Frank Denis (05 Jun 26)

  Validate DNS response questions Quickly reject received DNS responses whose question name, type, or class does not match the original query. Apply the check to the central response path, manual DNS exchanges, forwarding, and DoH/ODoH server probes. Suggested by Kun-Ta Chu, thanks!

• Frank Denis (04 Jun 26)

  Fix TCP fallback for truncated forwarded queries miekg/dns v2 can return both a partial response with the TC bit set and an unpack error for truncated UDP replies. Treat that case as a valid TCP fallback trigger instead of dropping the forwarded query, and use a fresh timeout context for the TCP retry.

• Frank Denis (28 May 26)

  Simplify

• Frank Denis (26 May 26)

  Update GitHub workflows to use Zizmor